Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

aikido

Unauthenticated RCE in WordPress core (wp2shell)

Jul 17, 2026 By Dania Durnas In Aikido
SQL injections are still among us. On July 17, WordPress released an emergency security update. Version 7.0.2 fixes an unauthenticated remote code execution flaw in WordPress core that an anonymous attacker can trigger against a stock install with no plugins involved. If your site runs an affected version, update today. WordPress.org has turned on forced auto-updates for affected sites because of how severe this is. We are tracking this vulnerability in Aikido Intel.
Read Post
cloudflare

Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities

Jul 17, 2026 By Daniele Molteni In Cloudflare
Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress. The protections address an Unauthenticated Remote Code Execution (RCE) vulnerability in WordPress's REST API and a related SQL Injection vulnerability. The WordPress security team disclosed the vulnerabilities to Cloudflare before public release so that we could prepare protections for customers.
Read Post

Resolve: One-Click Patching from Aurora Vulnerability Management

Jul 17, 2026 By Arctic Wolf Networks In Arctic Wolf
Vulnerability discovery is only half the story; remediation is where breach potential gets reduced. Resolve, part of Arctic Wolf's Aurora Vulnerability Management, brings one-click patch deployment across Windows, Mac, and Linux so security teams can move from "we found it" to "we fixed it" without the manual overhead. In this overview, see how Resolve turns vulnerability data into action: one-click patch orchestration, flexible scheduling, and clear visibility into remediation status — all inside the Aurora platform.
View Video
seemplicity

Vulnerability Exploitability: Is That Critical CVE Reachable?

Jul 16, 2026 By Jessica Amado In Seemplicity
A high CVSS score tells you how bad a vulnerability could be in theory, and EPSS tells you how likely it’s being exploited somewhere in the world, but neither knows anything about your environment. True vulnerability exploitability depends on reachability: whether the vulnerable code is actually loaded and called at runtime, whether it’s exposed on the network, and whether existing controls already block the path.
Read Post
aikido

Benchmarking 13 AI models on rediscovering known CVEs

Jul 16, 2026 By Rein Daelman In Aikido
TL;DR Every frontier model launch now comes with the same cybersecurity claim: it finds vulnerabilities. But does it work on a real bug in a real repository, or just on a curated example? Of the dozen models you could pick, which is worth trusting with code review? And since the strongest models cost ten times or more per run than the cheapest, what does that extra spend actually buy you in bugs found?
Read Post
sophos

SonicWall SMA1000 vulnerabilities in active exploitation

Jul 15, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On July 14, 2026, SonicWall disclosed two vulnerabilities in SonicWall SMA1000 appliances. Models 6210, 7210, and 8200v are affected. CVE-2026-15409 is a critical (CVSS score of 10.0) unauthenticated server-side request forgery (SSRF) flaw that allows an attacker to force the appliance to make requests to unintended destinations.
Read Post

How to Patch Vulnerabilities and Reduce Risk with Aurora Vulnerability Management and Resolve

Jul 15, 2026 By Arctic Wolf Networks In Arctic Wolf
Learn how to identify, prioritize, and remediate vulnerabilities using Aurora Vulnerability Management and the Resolve integration. This demo walks through filtering and targeting high-risk vulnerabilities, deploying patches across assets, and tracking patch jobs to reduce risk more efficiently.
View Video
cycognito

Emerging Threat: (CVE-2026-56164) SharePoint Server Privilege Escalation via Missing Authentication

Jul 15, 2026 By Igal Zeifman In CyCognito
CVE-2026-56164 is a privilege escalation vulnerability in on-premises Microsoft SharePoint Server, caused by a missing authentication check on a critical function (CWE-306). An unauthenticated attacker can exploit it over a network, with no credentials and no user interaction required. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), and Microsoft rates it Moderate.
Read Post
aikido

How Aikido Intel detects malware and vulnerabilities first

Jul 14, 2026 By Dania Durnas In Aikido
TL;DR: Aikido Intel is a real-time supply chain intelligence feed. It detects both malware and vulnerabilities in open-source ecosystems. Aikido's world-class researchers maintain our LLM-powered pipeline to find malware and validate the most malicious cases by hand. The vulnerability detection system monitors package changes across ecosystems to catch and document vulnerabilities that don’t have CVEs assigned.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.